Dropped-file hash links two samples beyond a shared HTTP endpoint
Both executables posted to the same IP address and PHP path, but a dropped-file hash shows that one analysis produced the exact content of the other sample. The delivered payload’s configuration matches observed HTTP traffic, clarifying its role without turning separate sandbox reports into a continuous attack trace.
Two executable samples produced HTTP POST requests to the same IP address and PHP path in sandbox analyses. That overlap could have been just a shared destination. But the file records reveal a stronger relationship: analyses of one executable recorded a dropped file whose SHA-256 exactly matches the other. What role did that delivered code play—and how much of its operation can the records actually reconstruct?
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read